Skip to content

Assume data-platform SSM role for /caterpillar/ secrets - #108

Open
prasadlohakpure wants to merge 2 commits into
mainfrom
fix/assume-dataplat-ssm-for-caterpillar-secrets
Open

Assume data-platform SSM role for /caterpillar/ secrets#108
prasadlohakpure wants to merge 2 commits into
mainfrom
fix/assume-dataplat-ssm-for-caterpillar-secrets

Conversation

@prasadlohakpure

@prasadlohakpure prasadlohakpure commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

Description

heimdall-task-role can assume heimdall-caterpillar-ssm-read, but ECS does not do that automatically. The Fargate task still runs as heimdall-task-role in 122610511428; a cross-account role cannot be set as taskRoleArn.

Caterpillar no longer hardcodes a role ARN. If the ECS task sets CATERPILLAR_SSM_ASSUME_ROLE_ARN, {{ secret }} assumes it for /caterpillar/ paths, then GetParameter. Other secrets keep using the task role.

Companion task-def env: https://github.com/patterninc/heimdall-config/pull/463

Types of changes

  • Bug fix (non-breaking change which fixes an issue)

Checklist

  • My code follows the code style of this project.
  • I have added tests to cover my changes.

Test plan

  • go test ./internal/pkg/config/
  • Deploy this Caterpillar tag and the heimdall-config task-def env, then rerun github_org_members_daily

heimdall-task-role can assume heimdall-caterpillar-ssm-read, but GetParameter still ran in the Heimdall account. {{ secret }} now assumes that role before reading /caterpillar/* parameters.
Copilot AI lite review requested due to automatic review settings August 20, 2026 15:43
@prasadlohakpure
prasadlohakpure requested a review from a team as a code owner August 20, 2026 15:43

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates Caterpillar’s config templating {{ secret "..." }} resolution to assume a cross-account SSM read role for /caterpillar/-scoped parameters, fixing failed secret lookups when running with Heimdall ECS task credentials.

Changes:

  • Add path-based role selection (/caterpillar/ → assume heimdall-caterpillar-ssm-read) before reading SSM parameters.
  • Add a unit test covering the role-ARN selection logic.
  • Promote AWS SDK modules (credentials, sts) from indirect to direct dependencies.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File Description
internal/pkg/config/secret.go Adds path-gated STS AssumeRole credentials for /caterpillar/ secrets before SSM reads.
internal/pkg/config/secret_test.go Tests the new path → role ARN mapping helper.
go.mod Marks required AWS SDK modules as direct dependencies to support the new STS/assume-role usage.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment on lines +36 to +40
if roleARN := assumeRoleARN(path); roleARN != `` {
cfg.Credentials = aws.NewCredentialsCache(
stscreds.NewAssumeRoleProvider(sts.NewFromConfig(cfg), roleARN),
)
}
Comment on lines +30 to +40
func getSecret(path string) (string, error) {
cfg, err := config.LoadDefaultConfig(ctx)
if err != nil {
return ``, err
}

if roleARN := assumeRoleARN(path); roleARN != `` {
cfg.Credentials = aws.NewCredentialsCache(
stscreds.NewAssumeRoleProvider(sts.NewFromConfig(cfg), roleARN),
)
}
Do not hardcode the role in Caterpillar. When CATERPILLAR_SSM_ASSUME_ROLE_ARN is set, assume it only for /caterpillar/ secrets; otherwise keep using the task role.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants